I — Datum
Electronic Signatures on Calibration Certificates
II — The Standard Names a Person
A calibration certificate carries the name, function and signature (or the equivalent) of the person authorizing its release. That phrase is doing real work. “Or equivalent” is what admits an electronic signature at all. Name and function are what make the signature mean something: an accreditation assessor is checking that a named individual, competent for that measurement, took responsibility for it.
Which settles a question people ask backwards. The interesting part is not whether software may sign a certificate; it is that software is not a person and has no function to state. A records system can hold the key, apply it on instruction, and refuse to apply it otherwise. What it cannot do is be the signatory, because there is nobody to name and nobody whose competence an assessor could review.
The practical consequence: the signing key belongs to the calibrating organization or the engineer who signs on its behalf, and it should be a digital ID they already hold. A vendor who mints signing keys for its customers has quietly made itself an authority over their legal signatures, which is a strange thing to accept from a software purchase.
III — What “Advanced” Means
Under eIDAS, Regulation (EU) No 910/2014, an advanced electronic signature must meet four conditions: it is uniquely linked to the signatory, it can identify the signatory, it is created using data the signatory can use under their sole control, and it is linked to the signed data such that any later change is detectable.
Note that only the last of those is about the document. The first three are about custody of a key. A signature is evidence about a person’s control of secret material at a moment in time, and it inherits every weakness in how that material is stored. A digital ID sitting unprotected on a shared drive produces signatures that satisfy the format and none of the intent.
PAdES (PDF Advanced Electronic Signatures, specified in ETSI EN 319 142-1) is the profile that carries such a signature inside a PDF. The signature is embedded in the file rather than shipped alongside it, so the evidence travels with the document, including into an email attachment or a supplier’s document system. Its siblings cover other containers: XAdES for XML, CAdES for CMS, ASiC for archives. A digital calibration certificate delivered as signed XML is using the same idea through a different door.
IV — The Four Levels, and What Each One Buys
| Level | Adds | What it establishes later |
|---|---|---|
| B-B | The signature and the signing certificate. | These bytes have not changed since they were signed, and here is who signed. Verifiable while that certificate is valid and has not been revoked. |
| B-T | A trusted timestamp over the signature. | The document existed in this form at a time attested by somebody other than the signer. |
| B-LT | The certificates and revocation data needed to validate, embedded in the file. | It can still be validated when the issuing authority is unreachable, or gone. |
| B-LTA | Document timestamps, renewable over time. | It can be validated many years on, past the expiry of the original certificate and past the weakening of the original algorithms. |
A signing time is not a timestamp. At B-B the time shown in a PDF reader is self-reported, taken from the signer’s own machine and signed along with everything else. It proves the signer’s clock said that, and nothing more. Anyone able to sign can set that clock.
That distinction decides whether a certificate can answer “was this instrument in calibration on the day we made those parts?” years after the fact. If the answer has to survive an audit, the level needs a real timestamp authority behind it, and the choice belongs in the procurement conversation rather than in a preference pane.
V — What a Signature Does Not Do
It does not make a certificate impossible to forge. Any document can be imitated, and a convincing counterfeit of a calibration certificate takes about as long as retyping one. Nothing in PAdES prevents that, and a system that claims otherwise is selling a feeling.
What a forger cannot produce is a valid signature from the issuer’s key. So the guarantee runs the other way round: not prevention, but detection, and detection that works offline, with no call back to the issuer, by anyone holding the file and a PDF reader. That is a smaller claim than the one people expect and a far more useful one, because it survives the case where the issuer has gone out of business.
It also says nothing whatsoever about whether the measurement was any good. A signature binds an identity to bytes. Whether those bytes describe a competent calibration against traceable standards is what accreditation is for, and no amount of cryptography substitutes for it.
VI — What to Ask a Laboratory
Four points worth settling in writing before accepting electronic certificates from a supplier:
Signing key. A named individual or the accredited legal entity rather than their
software vendor.
Assurance level. Where long-term validity is required,
B-LT or B-LTA rather than B-B, and say so on the purchase order.
Timestamp source, whether timestamped or self-reported. See
section IV; this is the one most often assumed rather than checked.
Private key custody. Sole control is a
requirement of the standard and a practice in the laboratory, and only one
of those is visible on the certificate.
On the receiving side, a signed PDF that cannot be validated is decoration. Confirm the PDF reader shows a signature panel and reports the certificate chain, before the first certificate arrives rather than during the audit.